Access drift outpaces the review cycle. By the time a quarterly or annual certification happens, service accounts, APIs and AI agents may already have expanded privileges, changed purpose or lost ownership. The result is governance that documents yesterday’s state while attackers exploit today’s access model.
When periodic certification stops being governance
IGA only works as governance when access is treated as a living state, not a snapshot. Periodic review can still be useful as a backstop, but on its own it creates blind spots between campaigns, especially where privileges, ownership and system purpose change faster than the review calendar.
That gap matters because modern access is rarely static. Service accounts, API credentials and automated workloads can accumulate rights through deployment changes, temporary exceptions, inherited roles or dormant entitlements that never return to baseline. A quarterly attestation may confirm yesterday’s approvals while today’s access already exceeds the intended model.
continuous governance shifts the question from “is this still approved?” to “what changed, who owns it, and should it still exist at all?” In practice, that means access decisions, ownership signals and entitlement drift are monitored throughout the lifecycle, not only at certification time. The point is not more paperwork; it is a shorter window in which excessive or orphaned access can persist.
Where the control breaks down
Periodic review fails when it becomes the primary control instead of one checkpoint in a broader governance loop. If revocation, role correction and ownership cleanup happen only after the review cycle, the organisation has already accepted a period of uncontrolled exposure. That is especially problematic for machine and application access, where the actor can keep operating long after the business reason for access has changed.
Continuous governance depends on upstream signals: provisioning events, role changes, workload changes, decommissioning notices, ticket closure, ownership transfer and anomalous use. IAM and IGA Basics is the right starting point for separating review activity from the broader governance model, while Joiner-Mover-Leaver (JML) Guide shows why changes in role or lifecycle must trigger access updates immediately, not eventually.
A second break point is ownership. When nobody can prove who owns a service account, API or agent, periodic review often becomes a rubber stamp because reviewers lack the context to challenge the entitlement. Access Reviews and Certification Guide focuses on making certifications actionable, and Role Mining and Role Design Guide helps prevent review noise caused by poorly structured roles and role sprawl.
What continuous governance changes in practice
Continuous governance does not eliminate reviews, it changes their purpose. Reviews become a quality gate for exceptions and higher-risk entitlements rather than the only mechanism for discovering drift. That requires a live view of effective access, timely offboarding, and cleanup when an identity outlives its business purpose.
In mature programmes, the governance loop includes event-driven remediation for privilege growth, ownership loss and stale access. NHI Lifecycle Management Guide is useful here because it treats lifecycle state as the control surface, and Segregation of Duties (SoD) Guide shows why toxic combinations should be prevented or detected continuously rather than discovered at attest time.
For organisations using platforms, the practical shift is to connect entitlement governance to change signals and inventory freshness. IGA Buyer’s Guide is relevant because tooling should support near-real-time lifecycle triggers, review context, and closed-loop remediation, not just campaign administration.
Risk and Threat Considerations
When governance is periodic, access drift becomes exploitable exposure. Attackers do not wait for the next certification cycle, and stale entitlements can give them a long dwell window to abuse overprivileged accounts, inherited roles or forgotten machine access before anyone re-validates the state.
Failure mechanism: Privileges change through deployment, role shifts or neglected ownership, but the control only inspects access on a schedule. That allows excessive rights, dormant access and unmanaged non-human accounts to persist between review cycles.
Impact: The organisation loses timely visibility into who can do what, so revocation lags behind change and compromise can turn into persistence, lateral movement or unauthorized system action before governance catches up.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Periodic reviews miss stale non-human access after purpose changes or decommissioning. |
| NHI-05 — Overprivileged NHI | Review-cycle governance leaves excessive machine privileges in place between campaigns. | |
| NHI-09 — NHI Reuse | Periodic attestation can miss reused credentials and roles across changing workloads. | |
| Recommendation — Trigger immediate deprovisioning when NHI ownership or purpose ends. Continuously right-size NHI permissions and revoke excess access on drift. Prevent credential and role reuse by tracking identity purpose and environment. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Continuous governance must manage credential lifecycle, rotation and revocation between reviews. |
| AC-2 — Account Management | The issue is account ownership, provisioning and timely disabling when context changes. | |
| AC-6 — Least Privilege | Access drift directly undermines least-privilege expectations between certification cycles. | |
| Recommendation — Automate credential rotation, expiry and revocation for stale authenticators. Use event-driven account lifecycle controls instead of review-only remediation. Continuously validate that entitlements remain minimal for current duties. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | The subject is governance failure from excessive access persisting beyond intended need. |
| GV.RM-01 — Risk Management Strategy | The question is about governance design and the risk created by review cadence gaps. | |
| ID.AM-01 — Physical Devices and Systems Inventoried | Continuous governance depends on current inventory of identities, workloads and access-bearing assets. | |
| Recommendation — Enforce least privilege continuously, not only during periodic attestation. Define an access-risk strategy that treats drift detection as an operating requirement. Maintain a current inventory of access-bearing identities and their owners. | ||
Practitioner Guidance
What to prioritise: Treat review cycles as evidence of control quality, not the control itself. The highest priority is to bind every privileged or non-human entitlement to an owner, a lifecycle event and a revocation trigger.
What to verify: Check whether changes in role, workload purpose, decommissioning or ticket closure actually produce access updates within the same operating window, rather than waiting for the next campaign. If they do not, your IGA process is documenting access rather than governing it.
Common mistake: Teams often try to fix review fatigue by reducing the number of certifications, when the real problem is stale entitlement state. The better measure is how quickly drift is detected and corrected after the business context changes.
Practitioner takeaway: Continuous governance is about shortening the time between access change and access correction; if your control only discovers drift on a calendar, it is already behind the environment.
Related resources from NHI Mgmt Group
- What breaks when GRC is treated as a periodic audit exercise instead of continuous identity governance?
- What breaks when risk management is treated as a periodic review instead of a continuous control process?
- What breaks when compliance is treated as a periodic exercise instead of a live control model?
- What breaks when data governance relies on periodic scans instead of continuous visibility?